Paul Gibson
Identity & Access Governance

Most systems don't get hacked.
Someone just logs in.

I'm Paul Gibson. I write the plain-English version of identity & access governance — the unglamorous corner of security where most breaches quietly begin. Identity, in simple terms.

Read on LinkedIn → What I write about
What this is

Identity, without the acronym soup.

Identity governance decides who can open which door — and, more importantly, who still can when they shouldn't. It's where budgets, audits and breaches all quietly collide. I explain it in plain English: the boring things that cost real money, told with the occasional straight face.

CISOs & security leads
IAM / IGA practitioners
Auditors & GRC teams
Anyone who owns access risk
Writing

The boring things that bite.

Short, plain-English pieces on the parts of identity everyone pretends are fine. New writing lands on LinkedIn a few times a week.

Joiners & leavers

The leaver who never left

The employee who resigned years ago, whose access politely stayed behind.

Service accounts

The account nobody owned

More access than you, a password from 2021, and everyone too scared to switch it off.

Certification

Why your access review is a lie

What "yes, approved" actually means when 400 lines need rubber-stamping by Friday.

Machine identity

The robots outnumber us now

We check the humans at the door while the service accounts climb in the window.

The business case

The £-figure the board asks

How to justify identity in money and risk, not features and acronyms.

Fundamentals

Segregation of Duties, with a bakery

Why the person who bakes the cake shouldn't also count the till.

Paul Gibson
About

I've spent about thirty years in cyber and identity — the last five running identity governance inside large financial-services organisations. Long enough to watch the same expensive mistakes repeat in slightly different fonts.

I started writing because the good explanations were all either sales pitches or 400-page standards, with nothing in between for the humans who actually have to run this stuff. So that's what I do here: the practitioner's plain-English take.

I'm also training as a speaker over the next year — so expect more of this out loud, on stages and podcasts, soon.

Stay in touch

Come for the boring bits.

The writing lives on LinkedIn for now. Connect there for the plain-English identity pieces — or just to tell me which of the above you've lived through.

Connect on LinkedIn Say hello